PHP2Shell: two PHP runtime RCE vulnerabilities and how to fix them

Two PHP runtime vulnerabilities, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, can lead to remote code execution, and have been officially fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. GHSA-w8hw-w9fx-j79w exploits memory corruption caused by improper cleanup of failed requests during the request shutdown phase; under Apache with mod_php, merely exhausting request memory can trigger it before application code executes, so any PHP application that can receive web requests is affected; the authors say source analysis shows FPM, FrankenPHP and LSAPI may also be affected. The Semgrep research team used two open-weight models, relying only on public information and spending less than the cost of a cup of coffee, to reproduce RCE on stock PHP/Apache with PHP 8.4.26 and 8.5.11.